vis audit [options]

# Full audit (offline if a synced cache exists, otherwise OSV API)
vis audit

# Severity gate
vis audit --severity high

# CI / pipeline output
vis audit --format json
vis audit --format sarif          # GitHub code-scanning
vis audit --format csaf           # Enterprise VEX pipelines
vis audit --format cyclonedx-vex  # SBOM + VEX in one document
vis audit --format gitlab         # GitLab CI dependency-scanning widget
vis audit --format junit          # JUnit XML (GitLab/Actions/Jenkins test reporters)

# Self-contained HTML report (auto-opens in a TTY)
vis audit --report ./audit-report.html

# Reachability filter — only flag vulns in statically-imported packages
vis audit --usage

# Fix loops (dry-run preview by default)
vis audit --show-fixes             # print fix suggestions (no apply, no rescan)
vis audit --fix                    # upgrade direct deps + rescan
vis audit --fix --yes              # non-interactive (required in CI)
vis audit --fix --allow-major      # permit major-version bumps
vis audit --fix-transitive         # write PM-specific overrides

# CI exit gates
vis audit --exit-code              # exit 1 on any finding
vis audit --fail-on high           # exit 1 on high/critical only

# Accepted-risk handling
vis audit --show-accepted          # include acknowledged risks
vis audit --sync                   # mirror accepted risks to native PM config

# Supply-chain policy engine
vis audit --policies license,vulnerability  # narrow to a subset for this run
vis audit --policies none                   # skip the policy engine entirely

import { defineConfig } from "@visulima/vis/config";

export default defineConfig({
    security: {
        audit: {
            // Default to the offline OSV cache when present.
            offlineByDefault: true,
            apply: {
                transitive: {
                    // CI gate — required alongside `--yes` before overrides are written.
                    enabled: false,
                },
            },
        },
        policies: {
            vulnerability: {
                // CI exit gate (overridable via --fail-on).
                failOn: "high",
                usage: {
                    // Apply the reachability filter by default.
                    enabled: true,
                },
            },
            license: {
                // SPDX allow / deny lists. Deny wins on any sub-expression
                // match within an SPDX expression (`(MIT OR GPL-3.0)`
                // is blocked when GPL-3.0 is on the deny list).
                allow: ["MIT", "Apache-2.0", "BSD-3-Clause", "ISC"],
                deny: ["GPL-3.0", "AGPL-3.0"],
            },
            installScripts: {
                // Build-script approval surface (mirrors pnpm allowBuilds
                // / strictDepBuilds). Strict mode blocks the install
                // when any dep declares an unapproved lifecycle script.
                allow: { esbuild: true, "@swc/core": true },
                strict: true,
            },
            unexpectedDeps: {
                // Net-new transitive detection. Either provide a
                // static allow list, a baseline lockfile path, or both
                // (intersection is enforced).
                baselineLockfile: "./security/baseline.pnpm-lock.yaml",
            },
        },
        socket: {
            enabled: true,
        },
        depsDev: {
            // No auth required. Pulls OpenSSF Scorecard signals +
            // GHSA advisories from api.deps.dev. Heavily cached
            // (24h project data, 7d versions + advisories).
            enabled: true,
        },
        // When both providers are enabled, this controls which one's
        // `score` wins on merge. Alerts from the secondary are still
        // appended and deduped by `key`.
        primaryProvider: "socket",
        // Workspace-scoped acknowledged risks (shared across all policies).
        acceptedRisks: {
            "some-package": {
                reason: "Vendor confirmed no fix available",
                acceptedAt: "2026-01-01",
                expiresAt: "2026-12-31",
            },
        },
    },
});